• We’ve added several new clients (including a well known member of the Fortune 1000!)
• We’ve added 101 new dedicated servers and over 20 cloud computing instances
• We’ve opened an office in Boston
• We’ve earned our PCI Level 1 MSP Certification
• We’ve hired several employees, a large number of contractors, and even picked up an intern!
• We’ve gone from 3 data centers in the USA to 13 data centers and 16 points-of-presence including several international facilities
• While our competitors have raised prices, we’ve managed to keep prices the same or actually reduce them in many places.  All this while providing newer more powerful hardware across the board
• We’ve introduced a new Oracle ATG Commerce Standard Hosting Package which provides excellent performance, stability, and security, for a very affordable package price
• Served well over 200 TB of content
• Partnered with JBoss/Redhat, Oracle, Akamai, Keynote, Knowledge Path, and many other industry leaders in order to provide the absolute best hosting, support, and related services
• More more!

The problem will get worse as future generations of processors start shipping with hex- and octo- core base configurations. In short Oracle’s licensing policy does not work with modern CPUs and ATG software pricing and infrastructure architecture.

So what could they do? I have a few solutions:

1. Allow for software disabling of cores. This is simple. Just add an “ATG Licensing Addendum” to the contracts that allows for this. Problem solved now and in the future.
2. Use the Oracle Standard Database licensing model based on “Sockets” not “Processors”. This is really a clean solution, has precedent in Oracle’s licensing practices, and scales well in the future.
3. Automatically allow all MC4 bundle customers to upgrade to 6 “Processors” of Commerce and 6 “Processors” of Search on ATG 10, for free. They were sold a small but deployable bundle of Production and Staging licenses. They’ve been paying their support fees. They deserve to still be able to run a small but deployable setup of Production and Staging.
4. Automatically upgrade any customers who have been sold ATG 10 with less than 6 “Processors” of Commerce and Search to 6+6. These customers have been sold an impossible to deploy list of licenses. Through ignorance (most likely) their ATG Sales rep sold them a lie. Make it right.

What do you think is most fair?

Oracle bought ATG at the end of last year. ATG 10 was released in a similar timeframe. ATG 10 introduced some great licensing changes. In ATG 9 and earlier, ATG’s License Manager enforced the license limitations encoded in the license files provided by ATG by checking the number of “CPUs” reported by the OS. Unfortunately this number captured cores + HyperThreaded logical cores, and as I talked about in earlier posts, this number increased in each new generation of chip causing issues with license costs. The typical solution was to disable HyperThreading in the BIOS and/or disable CPU cores within the OS in order to limit the server CPU resources to match the licenses. I’m not sure there was ever written policy around this, but it was common practice and many sales reps and sales engineers explicitly okayed this approach during pre-sales architecture planning.

In ATG 10 the licensing stopped being technically enforced via the License Manager and changed over to be enforced by audits. This means that HyperThreading is no longer a 2x penalty. This is the upside! It also means you can setup servers, or change IPs, without waiting for ATG to issue you new license files all the time. This is also handy.

Now comes the bad news.

I’ve just found out that Oracle’s (new) policy is that disabling cores is not permitted to meet license limits. That means you need valid ATG licenses for every physical core installed in any of your ATG servers. They’ve also dropped the “Staging” licenses which means you now need full price production licenses for your Staging environment hardware as well.

The current generation of Intel server CPUs are Westmere 56XX and they come in quad-core models on the low end, and hex-core models on the high end. The previous generation of CPUs are Nehalem 55XX and they come only in quad-core models. The generation before that were 54XXs and they also came only in quad-core models. The generation before that were 53XX, again quad-core only.

What this means is that the smallest ATG setup is basically two production app servers for failover/redundancy with single quad-core CPUs, and one staging app server, also with a single quad-core CPU. That’s 12 cores of ATG Commerce you need licensing for (or 6 ATG Commerce “processor” licenses – which is how they sell it now: Intel chips have a .5 core multiplier to convert from “processors” to physical cores). You also need ATG Search licenses. Given how most ATG 10 sites are massively reliant on Search for facets and site navigation you really need two production Search servers, again for failover/redundancy, and another Search box in stage. You *can* run Stage Search on the Stage App server, but you still need Search licenses for it. So again, you’re looking at 12 cores/6 “processors” minimum. Plus BCC and CSC Seats, etc…

So right now, anything less than 6 “Processors” of ATG Commerce and 6 “Processors” of ATG Search, isn’t actually deployable into a production + stage setup. Unfortunately some in-flight sales proposal out there right now are smaller than that. If you’re involved in an ATG deal with fewer licenses make sure you carefully go over your architecture and deployment plan with your ATG Sales rep and your hosting team.

Here’s another fun fact: when upgrading from a previous version to ATG 10, your currently licensed cores will get you ATG 10 “Processor” credits based on the same core multiplier. I’m not sure if your staging licenses will help at all, but if they do, they won’t count 100% or even close. What this means is that all of the MANY MANY customers out there who were sold MC4 bundles (4 cores of ATG Commerce + Search + Merch + CSC, etc…) have a truly terrible upgrade path. Those 4 cores of Commerce will get them 2 “Processors” of Commerce. Leaving them 4 “processors” short. Ditto for Search. That’s well over $1,000,000 to upgrade, although you’ll probably get some discounts from your sales rep.

That’s right: after paying hundreds of thousands of dollars a year in Support fees, entitling you to “free upgrades”, you’ll have to pony up somewhere in the six-figures range to upgrade to ATG 10.

Oracle’s Enterprise licensing practices do not apply well to standard small/medium deal ATG licensing levels and certainly not to existing ATG customers.

I spent about a day working on things before I discovered that I really should be using the Seam framework’s Identity Management feature.  So I threw out everything I’d done, and started by re-reading the docs, and went from there.  Seam’s Identity Management framework is VERY powerful, but is also a little complicated to get going and in many cases it seems like it would easier to just write stuff from scratch.  I’m banking on the powerful stuff being worth the initial learning curve and a little extra pain.

When I get the starter project in a more complete state I will be open sourcing the whole thing to help others along, but I wanted to share a few things I’ve learned so far:

In order to use the Email address as the login instead of a username, you need to remove the username property from your UserAccount entity and annotate the Email address property like so:

@NotNull
@UserPrincipal
@Email
public String getEmail() {
    return email;
}

Actions like Registration need a RunAsOperation inner class to handle the fine grained security controls that the Identity Management framework enforces:

    public void register() {
	verified = (confirm != null && confirm.equals(password));

	if (!verified) {
	    FacesMessages.instance().addToControl("confirmPassword", "Passwords do not match");
	}
	new RunAsOperation() {
	    public void execute() {
		try {
		    // Check if email address has already been used
		    if (identityManager.userExists(getEmail())) {
			FacesMessages.instance().addToControl("email", "Email has already been used.");
			return;
		    }
		    identityManager.createUser(email, password, mFirstName, mLastName);
		} catch (IdentityManagementException e) {
		    // TODO Auto-generated catch block
		    e.printStackTrace();
		}
		identityManager.grantRole(email, "member");
	    }
	}.addRole("admin").run();

	// Login the user
	identity.getCredentials().setUsername(email);
	identity.getCredentials().setPassword(password);
	identity.login();
    }

Populating custom properties on the User during things like registration requires observing events:

    @Observer(JpaIdentityStore.EVENT_PRE_PERSIST_USER)
    public void prePersistUser(UserAccount pNewUser) {
	// Setup additional UserAccount properties before the user is created
	pNewUser.setRegistrationDate(new Date());
	pNewUser.setOptIn(isOptIn());
    }

You can log audit events with the user’s IP address by doing things like this:

@Scope(ScopeType.EVENT)
@Name("userEvents")
public class UserEvents {
    @Logger
    private Log mLog;

    @Observer(JpaIdentityStore.EVENT_USER_AUTHENTICATED)
    public void loginSuccessful(UserAccount pUser) {
	mLog.info("User logged in with email: #0", pUser.getEmail());
	pUser.setLastLoginDate(new Date());
	Contexts.getSessionContext().set("currentUser", pUser);
	AuditEvent loginEvent = new AuditEvent(((ServletRequest) FacesContext.getCurrentInstance().getExternalContext()
		.getRequest()).getRemoteAddr(), pUser.getId(), "Login Success", null);
	Events.instance().raiseEvent("auditEvent", loginEvent);
    }
}

Hopefully I’ll have the starter project ready soon and will share it with you all. In the meantime, happy hacking!

image from Purpleslog

I’m happy to announce that Spark::red ATG Hosting has received our PCI DSS 1.2 Level 1 Certification as an eCommerce MSP.  We have been Level 2 certified for a while, but completing our Level 1 certification with TrustWave as our third-party auditor is a huge milestone for us.

PCI DSS is the Payment Card Industry’s Data Security Standard.  It is a set of requirements and guidelines designed to ensure merchants who handle or process credit cards, do so securely.  There are different levels based on transaction volume and Level 1 is the highest level, required for the largest volume merchants.  Level 1 is also the most difficult certification to gain, requiring the strictest security protections, the strongest policies, and a very in depth audit by a certified auditing company, such as TrustWave.  Our certification process has taken many months and the completion of our Level 1 Report of Compliance (RoC) is a testament to our dedication to providing the highest level of secure environments to our clients and safeguarding their systems and information, as well as the information of all our clients’ customers.

At Spark::red we focus strongly on Security and Performance beyond the core ATG hosting services.  We handle more PCI DSS requirements than any other ATG Hosting provider out there.  If you are looking for an ATG Hosting provider to help manage your ATG web application, we can offer PCI Level 1 compliant hosting and handle many of your security needs.

“Application Assets” go in the EAR in your store’s WAR.  Application Assets include CSS, JS, and all the images used for the application look and feel: logo, navigation images, css images, and so on.  These files typically only change in conjunction with a code/JSP release, and they need to be easy for the developers to manage on their local development instances.  Keeping everything needed to build, run, and browse the application in SVN and built into the EAR makes it easy to run developer instances and be sure you have the correct versions of the assets, etc…  It also allows you to leverage things like pack:tag which I discuss in my post about Secondary Asset Loading Time.  My only complaint is that ATG doesn’t have a built-in mechanism for handling versioning of static assets, which allows you to set long expiration dates in the caching headers without the issue of stale browser caches corrupting the view of your site after a deployment.

Obviously you don’t want your JBoss instances handling every request for every static asset in production, but by utilizing cache headers, transparent caching on your web servers, or a CDN solution, this is easily avoided while still keeping all of the benefits of managing the Application Assets within the EAR.

“Catalog and Marketing Assets” get deployed to the web servers.  These assets typically include product and category images, promotional images, white papers, PDFs, etc…  These files are changed frequently by the marketing team or by data feeds from an internal catalog management system on a schedule independent of code/JSP releases.  The files also tend to be larger.  The assets are often managed via SFTP, or ATG Publishing deploying to a Web Publishing Agent, or a combination of the two.

By managing your files in this way you get the most benefits with the least downsides.

Ruby on Rails or RoR obviously has huge buzz and is a very popular web application development framework lately.  Lots of people have praised it and lots of great sites have been built using it.  I’ve never bothered to learn it myself for a few reasons.  First I’m a Java guy (ATG and Seam) and have been for years.  Given limited time and limited brain capacity I’d rather learn more Java/Java Frameworks/etc… than try to learn a whole new language.  Secondly many trusted friends advised me that while RoR does somethings REALLY well and makes some things REALLY easy, once you need to try to break outside of the pre-imagined structure/features that RoR provides out of the box, things rapidly go downhill.  Those reasons aside, the high level of buzz has meant I’ve always been somewhat curious, so this opportunity to finally get my hands a little dirty with RoR was welcome.

Getting started with RoR on Mac OS X is very easy.  It’s pre-installed and works right out of the box.  However after upgrading Rails and the gems I ran into a known blocking bug which after some Googling I was able to fix by downgrading rake to 0.8.7 in the Gemfile.  So not a 100% smooth start, but not too bad.

The Rails generate scaffold commands make it very easy to create a data object, the related schema changes (managed through the rake migration mechanism), and related CRUD pages and controllers.  You can be up and running very quickly and creating, browsing, editing, and deleting records.  This can make it very easy to get a basic application laid out, and provides lots of plumbing automatically.

I didn’t get much farther than some simple controller modifications, outbound e-mail sending, etc…  so I’m far from a real RoR developer.  However I ran into enough pain points so far that I don’t think RoR is for me.  I don’t want to start any language/framework wars, but here is what I ran into:

A lot of the “magic” seems great at first, but as soon as you want go outside of the box or tweak how things are working, it becomes a massive liability.  For instance when using the generate scaffold command to create data objects you can setup relationships/foreign keys by passing in a column name that matches the form OtherClass_id:integer, which will be interpreted to be a FK association to the other class’s id column to join the objects.  This is great.  However, what if you want to add two relationships to the same Other class?  For instance an Message has a Sender and a Recipient, both of which are Users.  I can use user_id:integer for one, but how do I do the other?  How do I use column/property names that don’t fit that naming convention, for instance I’d want sender_id and recipient_id.  None of the getting started guides I was able to find covered that.  Googling for things like “scaffold multiple foreign keys” didn’t answer the question, etc…  I’m sure it’s possible, but finding out how wasn’t easy, and the default way hides and obscures the actual plumbing so it’s not easy to figure out how to make simple changes or additions.

Data object classes in the app/model area all extend ActiveRecord::Base and as generated by generate scaffold are completely empty.  There’s no clue or indication of the fields, any logic available, any relationships, property types, etc…

Emailer classes use magic mappings between method names and e-mail templates.  Because it’s “magic” I have no idea how to change a template file name if I wanted to.  App/helper classes are created, but they’re empty, so I have no idea what they are doing, or meant to do.  And so on.  If I was an expert RoR developer I’m sure I’d know, or if I read a few books I’d understand, but starting from scratch and trying to learn as I go, it proved very frustrating.

The much touted RoR Community proved to be more of a liability than an asset to me.  Especially when combined with the many, rapid, backwards incompatible, RoR releases that have come out so far.  When looking for information, guides, and answers related to RoR you end up finding things spread all over: blogs, forums, mailing lists, Ruby sites, RoR sites, groups, etc…  Most of these posts/documents refer to older versions of RoR.  Most of them don’t have dates or specify which version they are working with.  Many questions on forums are unanswered.  The end result is you find what you hope is a reasonable solution for an issue only to find that the code sample or directions are written for a previous version of RoR, and trying to follow the instructions or paste the code in the current RoR version results in weird errors or worse.

Each new version of RoR seems to massively change and/or break common APIs and change how things are supposed to be done, etc…  I ran into several situations where it seems like a method was renamed, with no backwards compatible alias left in place, for no other reason than they wanted to change the name, which breaks older code for  no real purpose.

I’m also not a fan of weakly typed languages.  Strongly typed languages provide compile time validation, IDE auto-completion, and easy to navigate API documentation.  With larger, more complex projects, or projects involving many developers, or projects utilizing many 3rd party libraries, these advantages become significant in my opinion.

So from my standpoint, JBoss Seam provides most of the advantages of RoR, including several improvements, without many of the liabilities.  Plus it’s in Java which is my strongest programming language.  I’ll stick with Seam, but I’ll still respect the creations of folks who use other tools, including RoR.

It didn’t take long before someone figured out that her resume was actually my resume.

Imitation is the sincerest form of flattery?

It’s hard to fake your way in to “hard” technical fields where either you know your stuff or you don’t and it’s pretty quickly apparent which side you’re on. But the ATG community is so small that it’s doubly silly to try to pass someone’s resume off as your own.

Anyhow, I thought that whole story was pretty crazy so I had to share.

Boston is a hub of ATG activity, and we would like to bring the community together for a casual evening of meeting new people and learning a bit at the same time. Both business and technical attendees are welcome and we plan to offer content for all audiences. We plan on making this a regular occurrence, but let’s kick off 2011 with a great ATG User Group event!

Click here: Sparkred ATG User Group – Boston for details and to register for this FREE event! I look forward to seeing you there!

The book contains extensive performance/load test results giving you hard data to work with when deciding which changes to make in your environment.  Some of the results were very surprising and the book has a lot of valuable data.

The author, Francesco Marchioni, also runs a popular JBoss related blog called MasterTheBoss.com.  There are a ton of great articles and posts there, so check it out!